Openemr CVE-2026-33304

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates this is a network-accessible vulnerability requiring only low-complexity exploitation and valid user credentials, with high confidentiality impact. The attack requires authentication (PR:L) but can be automated without user interaction (UI:N), making it practical for insider threats or compromised low-privilege accounts. While the CVSS score of 6.5 is categorized as Medium severity, the real-world risk is significant in healthcare contexts due to the disclosure of protected health information (PHI) and patient names, which triggers HIPAA compliance concerns and potential regulatory fines. The existence of a published proof-of-concept on GitHub substantially increases exploitation likelihood. This vulnerability is particularly concerning because it requires no special privileges—any authenticated user (including clinic staff with minimal access) can enumerate and access records across the entire organization. Organizations running vulnerable OpenEMR versions should prioritize patching.

An authenticated clinic receptionist with limited EHR access crafts a GET request to the dated reminders log endpoint with sentBy[]=1&sentBy[]=2&sentBy[]=3, iterating through different user IDs. Because no authorization checks validate whether the receptionist should access reminders from physicians or other users, the application returns reminder messages including patient names and free-text clinical notes sent to or by those users. The attacker can enumerate the entire organization's reminder history in minutes, exfiltrating patient information without triggering any security alerts since the requests appear legitimate. A public proof-of-concept demonstrates this technique, making exploitation trivial for any insider or external attacker with valid credentials.